Email: 570599 Autolearn: 0 AvgScore: 1.29 AvgScanTime: 2.07 sec Spam: 97005 Autolearn: 0 AvgScore: 13.28 AvgScanTime: 2.61 sec Ham: 473594 Autolearn: 0 AvgScore: -1.16 AvgScanTime: 1.96 sec Time Spent Running SA: 327.44 hours Time Spent Processing Spam: 70.25 hours Time Spent Processing Ham: 257.19 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 86830 88.32 89.51 88.07 2 DCC_CHECK 74995 50.63 77.31 45.16 3 XM_B_Unicode 64255 70.35 66.24 71.19 4 DKIM_SIGNED 63312 77.15 65.27 79.58 5 XM_DK_Pass 60781 75.51 62.66 78.15 6 XMListUnsubscribeExists 58673 56.89 60.48 56.16 7 DKIM_VALID 58485 72.89 60.29 75.47 8 BAYES_50 51647 51.27 53.24 50.86 9 DKIM_VALID_AU 42942 53.77 44.27 55.72 10 XM_B_Unicode3 41296 42.68 42.57 42.70 11 MIME_HTML_ONLY 35590 24.46 36.69 21.95 12 HTML_FONT_LOW_CONTRAST 29695 30.50 30.61 30.48 13 RELAYCOUNTRY_META 28845 10.19 29.74 6.19 14 XM_DK_Undo_02 26229 8.94 27.04 5.23 15 LOC_TINY_FONT_1 25720 25.82 26.51 25.68 16 XMSubLong 25632 24.11 26.42 23.64 17 FSL_BULK_SIG 23183 10.05 23.90 7.21 18 FVGT_m_MULTI_ODD 21996 23.33 22.68 23.46 19 XM_Body_Dirty_Words 21383 16.28 22.04 15.09 20 MultiRelay 21322 19.48 21.98 18.97 21 BOTNET 20597 5.71 21.23 2.53 22 DCC_CHECK_NEGATIVE 19660 47.44 20.27 53.01 23 DKIM_VALID_EF 19516 26.89 20.12 28.28 24 XM_UncommonTLD01 19277 6.24 19.87 3.45 25 BAYES_99 19264 5.44 19.86 2.49 26 BOTNET_IPINHOSTNAME 17859 7.44 18.41 5.19 27 T_TM2_M_HEADER_IN_MSG 17845 26.85 18.40 28.58 28 LOTS_OF_MONEY 15972 11.37 16.47 10.32 29 T_KAM_HTML_FONT_INVALID 15809 18.33 16.30 18.75 30 BAYES_999 15784 4.39 16.27 1.95 31 XM_Multi_Part_URI 15379 13.34 15.85 12.82 32 SpammyFromTLD_02 15061 3.32 15.53 0.82 33 UNTRUSTED_Relay 14619 4.33 15.07 2.13 34 TR_DCC_Bayes_99 14592 3.72 15.04 1.40 35 T_REMOTE_IMAGE 12502 5.75 12.89 4.29 36 KHOP_HELO_FCRDNS 12190 3.90 12.57 2.12 37 XMSexyCombo_05 11573 5.88 11.93 4.64 38 HTML_IMAGE_RATIO_02 11456 10.03 11.81 9.66 39 BODY_URI_ONLY 10418 1.90 10.74 0.09 40 XMNumbers 10304 4.87 10.62 3.69 41 HTML_SHORT_LINK_IMG_1 10271 1.83 10.59 0.04 42 REPLYTO_WITHOUT_TO_CC 10252 1.83 10.57 0.04 43 HTML_IMAGE_ONLY_12 10208 1.95 10.52 0.19 44 XM_Evil_Numbers_Gen 10011 10.30 10.32 10.30 45 MIME_HEADER_CTYPE_ONLY 9544 1.77 9.84 0.12 46 XM_DIRTYINTL 9204 4.49 9.49 3.47 47 XM_H_Long_From03 9107 1.67 9.39 0.09 48 XMLongAddy 9104 1.64 9.39 0.06 49 T_XMDrugObfuBody_14 9003 8.40 9.28 8.22 50 MPART_ALT_DIFF 8867 4.54 9.14 3.60 51 XMSubMetaSx_00 8828 4.90 9.10 4.04 52 XM_UB50 8371 2.31 8.63 1.02 53 XM_H_Long_From01 8180 6.70 8.43 6.35 54 RCVD_IN_BL_SPAMCOP_NET 7992 2.03 8.24 0.76 55 FROM_MISSP_REPLYTO 7938 1.40 8.18 0.01 56 XM_SPF_SoftFail 7719 3.02 7.96 2.00 57 LotsOfNums_01 7656 8.86 7.89 9.05 58 TooManyTo_001 7377 8.01 7.60 8.10 59 RCVD_IN_MSPIKE_H2 7161 8.23 7.38 8.40 60 XM_B_SpammyTLD 6651 4.21 6.86 3.67 61 HTML_IMAGE_RATIO_04 6390 6.59 6.59 6.59 62 XM_B_Phish_Phrases 6364 6.13 6.56 6.04 63 BOTNET_NORDNS 5391 0.99 5.56 0.05 64 MIME_QP_LONG_LINE 5277 5.99 5.44 6.10 65 BAYES_60 5262 3.89 5.42 3.58 66 DKIM_INVALID 4827 4.26 4.98 4.11 67 XM_CamelCaseFrm001 4703 2.55 4.85 2.08 68 BAYES_80 4628 2.37 4.77 1.88 69 BAYES_40 4323 5.80 4.46 6.07 70 MIME_HTML_ONLY_MULTI 4267 2.37 4.40 1.95 71 HTML_MIME_NO_HTML_TAG 4153 2.53 4.28 2.17 72 XM_URI_RBL 4126 1.07 4.25 0.42 73 RELAYCOUNTRY_GB 4056 1.60 4.18 1.07 74 RELAYCOUNTRY_JP 4028 0.73 4.15 0.02 75 RCVD_IN_RP_RNBL 3994 0.74 4.12 0.05 76 MIME_HTML_MOSTLY 3985 2.84 4.11 2.58 77 RELAYCOUNTRY_CA 3967 2.13 4.09 1.72 78 BAYES_20 3807 4.76 3.92 4.93 79 FVGT_m_MULTI_ODD_EMAIL 3770 0.68 3.89 0.02 80 US_DOLLARS_3 3647 2.65 3.76 2.42 81 TM2_M_URI_OPT_OUT 3524 2.45 3.63 2.21 82 RCVD_IN_SORBS_DUL 3519 0.94 3.63 0.39 83 BAYES_00 3493 21.87 3.60 25.62 84 RELAYCOUNTRY_FR 3491 1.06 3.60 0.54 85 XMStrtUSub 3400 4.12 3.50 4.25 86 XM_SendGrid 3291 6.14 3.39 6.70 87 DKIM_ADSP_CUSTOM_MED 3253 1.48 3.35 1.10 88 URI_HEX 3191 2.39 3.29 2.20 89 RCVD_IN_PSBL 3165 0.59 3.26 0.04 90 FORGED_GMAIL_RCVD 3087 0.91 3.18 0.45 91 NML_ADSP_CUSTOM_MED 3083 1.27 3.18 0.88 92 XMSexyCombo_01 3074 1.26 3.17 0.87 93 NORDNS_LOW_CONTRAST 3065 0.54 3.16 0.01 94 XM_OfRef6 2977 1.79 3.07 1.53 95 XMMoneyMeta_00 2965 0.87 3.06 0.42 96 SUBJ_ALL_CAPS 2945 2.67 3.04 2.59 97 TR_LOTS_OF_MONEY2 2864 0.87 2.95 0.45 98 T_MONEY_PERCENT 2864 0.87 2.95 0.45 99 T_Symld_Words_02 2791 1.04 2.88 0.67 100 PLING_QUERY 2762 0.88 2.85 0.48 101 MultiRelay_Combo 2756 0.67 2.84 0.23 102 MultiRelay_CC 2756 0.67 2.84 0.23 103 HTML_IMAGE_RATIO_08 2708 2.29 2.79 2.18 104 T_XMDrugObfuBody_08 2684 1.87 2.77 1.68 105 XMDiploma_00 2682 2.01 2.76 1.86 106 T_XMHurry_00 2654 1.44 2.74 1.17 107 FROM_EXCESS_BASE64 2600 3.60 2.68 3.79 108 HTML_IMAGE_RATIO_06 2572 3.24 2.65 3.36 109 NO_DNS_FOR_FROM 2510 1.33 2.59 1.08 110 MONEY_FROM_MISSP 2482 0.45 2.56 0.02 111 XM_BadFromFormat 2286 0.49 2.36 0.11 112 ADVANCE_FEE_3_NEW 2271 0.40 2.34 0.00 113 MAILING_LIST_MULTI 2230 2.50 2.30 2.54 114 TR_XM_PHPDW 2215 0.87 2.28 0.58 115 XMBody_17 2208 1.04 2.28 0.78 116 URG_BIZ 2199 0.41 2.27 0.03 117 TR_XM_PHPForged 2196 0.86 2.26 0.57 118 T_TooManySym_01 2193 5.78 2.26 6.50 119 T_FILL_THIS_FORM_SHORT 2183 1.15 2.25 0.92 120 TR_XM_FormFill2 2183 0.85 2.25 0.57 121 XM_H_PHPOS 2179 0.85 2.25 0.56 122 BAYES_95 2157 1.23 2.22 1.02 123 DKIM_ADSP_NXDOMAIN 2137 0.95 2.20 0.69 124 BAYES_05 2123 3.09 2.19 3.27 125 TR_Symld_Words 2081 2.02 2.15 1.99 126 RCVD_IN_IADB_LISTED 2021 5.08 2.08 5.70 127 SpammyFromTLD_01 2007 1.12 2.07 0.93 128 TR_XM_DK_Bayes 1918 18.26 1.98 21.60 129 RCVD_IN_IADB_SPF 1908 4.44 1.97 4.95 130 FORM_FRAUD_3 1876 0.33 1.93 0.00 131 RCVD_IN_IADB_SENDERID 1871 3.94 1.93 4.36 132 RCVD_IN_IADB_DK 1863 3.86 1.92 4.25 133 XMGenDplmaNmb 1863 1.25 1.92 1.11 134 XMSubMetaI_00 1847 1.28 1.90 1.15 135 TR_XM_DK_Bayes1 1826 17.66 1.88 20.89 136 ALL_TRUSTED 1758 10.60 1.81 12.40 137 LongTLD 1709 0.45 1.76 0.18 138 TR_XM_RelayPhish 1699 1.17 1.75 1.05 139 TM2_M_VERY_LONG_WORD 1673 1.44 1.72 1.38 140 FROM_LOCAL_NOVOWEL 1672 0.31 1.72 0.02 141 T_XMDrugObfuBody_00 1649 1.01 1.70 0.87 142 XMSubject_48 1519 0.29 1.57 0.02 143 MPART_ALT_DIFF_COUNT 1502 0.57 1.55 0.37 144 XMPhish11 1495 1.16 1.54 1.08 145 TR_XM_DK_SendGrid 1488 3.12 1.53 3.45 146 TR_Mismatch_TLD_02 1482 0.37 1.53 0.13 147 RELAYCOUNTRY_DE 1428 0.68 1.47 0.52 148 TR_Mismatch_TLD_01 1411 0.42 1.45 0.21 149 XM_H_Long_From02 1395 1.17 1.44 1.11 150 RELAYCOUNTRY_VN 1364 0.25 1.41 0.02 151 DIET_1 1347 0.56 1.39 0.39 152 HTML_IMAGE_ONLY_08 1333 0.34 1.37 0.13 153 HDRS_LCASE_IMGONLY 1330 0.28 1.37 0.05 154 RELAYCOUNTRY_NL 1310 0.39 1.35 0.19 155 DATE_IN_PAST_03_06 1303 0.42 1.34 0.23 156 URI_TRY_3LD 1297 1.51 1.34 1.55 157 SHORT_URI 1293 0.25 1.33 0.02 158 XM_H_PHPMailer 1290 0.60 1.33 0.45 159 XMStockSpam_06 1281 1.39 1.32 1.41 160 XM_GoogleGroups 1265 1.21 1.30 1.19 161 URIBL_DBL_ABUSE_REDIR 1241 0.23 1.28 0.01 162 XMBrknScrpt_02 1236 0.98 1.27 0.91 163 XM_DK_Undo_01 1232 1.56 1.27 1.62 164 HELO_NODOT 1222 1.52 1.26 1.58 165 HELO_NO_DOMAIN 1221 1.52 1.26 1.58 166 RCVD_IN_RP_SAFE 1213 8.69 1.25 10.21 167 TR_XM_DK_Bayes2 1196 14.77 1.23 17.55 168 DEAR_BENEFICIARY 1195 0.21 1.23 0.00 169 FROM_SUSPICIOUS_NTLD 1193 0.23 1.23 0.03 170 TooManyTo_002 1190 1.81 1.23 1.93 171 RELAYCOUNTRY_IN 1177 0.32 1.21 0.14 172 XMSubMetaSxObfu_03 1167 0.75 1.20 0.66 173 URIBL_BLACK 1162 0.24 1.20 0.04 174 XMBody_78 1153 0.66 1.19 0.55 175 FROM_SUSPICIOUS_NTLD_FP 1144 0.22 1.18 0.02 176 TR_XM_FormFill 1140 0.20 1.18 0.00 177 XMSexyCombo_04 1138 0.41 1.17 0.26 178 NUMERIC_HTTP_ADDR 1115 0.50 1.15 0.37 179 XM_H_PHPOS_M 1087 0.33 1.12 0.17 180 MONEY_FRAUD_8 1083 0.19 1.12 0.00 181 RCVD_IN_MSPIKE_WL 1080 4.49 1.11 5.18 182 ADVANCE_FEE_5_NEW_MONEY 1076 0.19 1.11 0.00 183 XM_UB60 1068 0.23 1.10 0.05 184 XMPhish14 1065 0.56 1.10 0.45 185 MISSING_HEADERS 1056 0.52 1.09 0.41 186 SUBJ_DOLLARS 1055 0.72 1.09 0.65 187 RDNS_DYNAMIC 1049 0.54 1.08 0.43 188 XMPhish30 1030 0.68 1.06 0.60 189 RCVD_IN_MSPIKE_H3 1028 4.24 1.06 4.89 190 TR_LOTS_OF_MONEY3 1024 0.46 1.06 0.33 191 TooManyTo_003 980 1.27 1.01 1.32 192 TR_MetaPhish_Combo_01 974 1.64 1.00 1.77 193 RELAYCOUNTRY_SG 960 0.31 0.99 0.17 194 FSL_HELO_NON_FQDN_1 957 0.18 0.99 0.01 195 XMBdyGiftCard01 946 1.44 0.98 1.54 196 XMSubMetaSSx_00 945 0.39 0.97 0.27 197 HTML_FONT_FACE_BAD 942 0.66 0.97 0.59 198 UNICODE_OBFU_ASC 942 0.17 0.97 0.01 199 TM2_M_A_HREF_HREF 932 0.92 0.96 0.91 200 DATE_IN_PAST_06_12 928 0.37 0.96 0.25 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 417099 88.32 89.51 88.07 2 DKIM_SIGNED 376901 77.15 65.27 79.58 3 XM_DK_Pass 370106 75.51 62.66 78.15 4 DKIM_VALID 357436 72.89 60.29 75.47 5 XM_B_Unicode 337157 70.35 66.24 71.19 6 XMListUnsubscribeExists 265958 56.89 60.48 56.16 7 DKIM_VALID_AU 263886 53.77 44.27 55.72 8 DCC_CHECK_NEGATIVE 251040 47.44 20.27 53.01 9 BAYES_50 240871 51.27 53.24 50.86 10 DCC_CHECK 213874 50.63 77.31 45.16 11 XM_B_Unicode3 202216 42.68 42.57 42.70 12 HTML_FONT_LOW_CONTRAST 144340 30.50 30.61 30.48 13 T_TM2_M_HEADER_IN_MSG 135336 26.85 18.40 28.58 14 DKIM_VALID_EF 133934 26.89 20.12 28.28 15 LOC_TINY_FONT_1 121631 25.82 26.51 25.68 16 BAYES_00 121312 21.87 3.60 25.62 17 XMSubLong 111946 24.11 26.42 23.64 18 FVGT_m_MULTI_ODD 111110 23.33 22.68 23.46 19 MIME_HTML_ONLY 103977 24.46 36.69 21.95 20 TR_XM_DK_Bayes 102278 18.26 1.98 21.60 21 TR_XM_DK_Bayes1 98919 17.66 1.88 20.89 22 MultiRelay 89823 19.48 21.98 18.97 23 T_KAM_HTML_FONT_INVALID 88784 18.33 16.30 18.75 24 TR_XM_DK_Bayes2 83110 14.77 1.23 17.55 25 XM_Body_Dirty_Words 71482 16.28 22.04 15.09 26 XM_Multi_Part_URI 60730 13.34 15.85 12.82 27 ALL_TRUSTED 58737 10.60 1.81 12.40 28 LOTS_OF_MONEY 48890 11.37 16.47 10.32 29 XM_Evil_Numbers_Gen 48757 10.30 10.32 10.30 30 RCVD_IN_RP_SAFE 48366 8.69 1.25 10.21 31 HTML_IMAGE_RATIO_02 45761 10.03 11.81 9.66 32 LotsOfNums_01 42880 8.86 7.89 9.05 33 RCVD_IN_RP_CERTIFIED 41494 7.35 0.44 8.76 34 RCVD_IN_MSPIKE_H2 39792 8.23 7.38 8.40 35 T_XMDrugObfuBody_14 38915 8.40 9.28 8.22 36 TooManyTo_001 38348 8.01 7.60 8.10 37 XM_DKIMWhitelistDomains 36578 6.41 0.01 7.72 38 FSL_BULK_SIG 34156 10.05 23.90 7.21 39 XM_SendGrid 31740 6.14 3.39 6.70 40 HTML_IMAGE_RATIO_04 31208 6.59 6.59 6.59 41 T_TooManySym_01 30794 5.78 2.26 6.50 42 XM_H_Long_From01 30066 6.70 8.43 6.35 43 RELAYCOUNTRY_META 29313 10.19 29.74 6.19 44 MIME_QP_LONG_LINE 28909 5.99 5.44 6.10 45 BAYES_40 28750 5.80 4.46 6.07 46 XM_B_Phish_Phrases 28614 6.13 6.56 6.04 47 RCVD_IN_IADB_LISTED 26979 5.08 2.08 5.70 48 XM_DK_Undo_02 24781 8.94 27.04 5.23 49 BOTNET_IPINHOSTNAME 24575 7.44 18.41 5.19 50 RCVD_IN_MSPIKE_WL 24550 4.49 1.11 5.18 51 RCVD_IN_IADB_SPF 23454 4.44 1.97 4.95 52 BAYES_20 23338 4.76 3.92 4.93 53 RCVD_IN_MSPIKE_H3 23162 4.24 1.06 4.89 54 XMSexyCombo_05 21988 5.88 11.93 4.64 55 RCVD_IN_IADB_SENDERID 20636 3.94 1.93 4.36 56 T_REMOTE_IMAGE 20329 5.75 12.89 4.29 57 XMStrtUSub 20137 4.12 3.50 4.25 58 RCVD_IN_IADB_DK 20137 3.86 1.92 4.25 59 DKIM_INVALID 19465 4.26 4.98 4.11 60 XMSubMetaSx_00 19148 4.90 9.10 4.04 61 XM_PDF 19006 3.44 0.62 4.01 62 FROM_EXCESS_BASE64 17958 3.60 2.68 3.79 63 RCVD_IN_IADB_VOUCHED 17643 3.22 0.73 3.73 64 IN_ZIMBRA_NJ_WHITELIST 17492 3.07 0.02 3.69 65 XMNumbers 17482 4.87 10.62 3.69 66 XM_B_SpammyTLD 17389 4.21 6.86 3.67 67 MPART_ALT_DIFF 17043 4.54 9.14 3.60 68 BAYES_60 16956 3.89 5.42 3.58 69 XM_DIRTYINTL 16425 4.49 9.49 3.47 70 XM_UncommonTLD01 16345 6.24 19.87 3.45 71 TR_XM_DK_SendGrid 16319 3.12 1.53 3.45 72 HTML_IMAGE_RATIO_06 15905 3.24 2.65 3.36 73 BAYES_05 15491 3.09 2.19 3.27 74 TO_MALFORMED 13980 2.45 0.03 2.95 75 SUBJ_ALL_CAPS 12273 2.67 3.04 2.59 76 MIME_HTML_MOSTLY 12224 2.84 4.11 2.58 77 UNPARSEABLE_RELAY 12144 2.26 0.77 2.56 78 MAILING_LIST_MULTI 12008 2.50 2.30 2.54 79 BOTNET 11994 5.71 21.23 2.53 80 BAYES_99 11793 5.44 19.86 2.49 81 US_DOLLARS_3 11466 2.65 3.76 2.42 82 RCVD_IN_IADB_OPTIN 11177 2.03 0.44 2.36 83 T_TooManySym_02 10915 1.99 0.46 2.30 84 TVD_RCVD_IP 10700 1.98 0.61 2.26 85 TM2_M_URI_OPT_OUT 10465 2.45 3.63 2.21 86 URI_HEX 10428 2.39 3.29 2.20 87 HTML_IMAGE_RATIO_08 10348 2.29 2.79 2.18 88 HTML_MIME_NO_HTML_TAG 10263 2.53 4.28 2.17 89 UNTRUSTED_Relay 10099 4.33 15.07 2.13 90 KHOP_HELO_FCRDNS 10041 3.90 12.57 2.12 91 XM_CamelCaseFrm001 9836 2.55 4.85 2.08 92 XM_SPF_SoftFail 9493 3.02 7.96 2.00 93 TR_Symld_Words 9447 2.02 2.15 1.99 94 MIME_HTML_ONLY_MULTI 9258 2.37 4.40 1.95 95 BAYES_999 9253 4.39 16.27 1.95 96 TooManyTo_002 9158 1.81 1.23 1.93 97 BAYES_80 8901 2.37 4.77 1.88 98 XMDiploma_00 8796 2.01 2.76 1.86 99 CK_HELO_DYNAMIC_SPLIT_IP 8490 1.55 0.35 1.79 100 HELO_DYNAMIC_IPADDR2 8421 1.49 0.09 1.78 101 TR_MetaPhish_Combo_01 8384 1.64 1.00 1.77 102 RELAYCOUNTRY_CA 8162 2.13 4.09 1.72 103 T_XMDrugObfuBody_08 7963 1.87 2.77 1.68 104 XM_DK_Undo_01 7663 1.56 1.27 1.62 105 HELO_NODOT 7469 1.52 1.26 1.58 106 HELO_NO_DOMAIN 7467 1.52 1.26 1.58 107 IN_HORDE_ADDRESS_BOOK 7419 1.31 0.04 1.57 108 INVALID_MSGID 7353 1.37 0.45 1.55 109 URI_TRY_3LD 7340 1.51 1.34 1.55 110 XMBdyGiftCard01 7298 1.44 0.98 1.54 111 XM_OfRef6 7227 1.79 3.07 1.53 112 ANY_BOUNCE_MESSAGE 7060 1.33 0.53 1.49 113 BOUNCE_MESSAGE 7058 1.33 0.53 1.49 114 XMStockSpam_06 6659 1.39 1.32 1.41 115 TR_DCC_Bayes_99 6609 3.72 15.04 1.40 116 TM2_M_VERY_LONG_WORD 6520 1.44 1.72 1.38 117 TooManyTo_003 6274 1.27 1.01 1.32 118 XM_GoogleGroups 5642 1.21 1.30 1.19 119 XMGappySubj_01 5578 1.05 0.42 1.18 120 T_XMHurry_00 5538 1.44 2.74 1.17 121 USER_IN_DEF_DKIM_WL 5494 0.96 0.01 1.16 122 XMSubMetaI_00 5463 1.28 1.90 1.15 123 XMCapTrack 5442 1.00 0.27 1.15 124 XMGenDplmaNmb 5275 1.25 1.92 1.11 125 XM_H_Long_From02 5262 1.17 1.44 1.11 126 DKIM_ADSP_CUSTOM_MED 5197 1.48 3.35 1.10 127 NO_DNS_FOR_FROM 5099 1.33 2.59 1.08 128 XMPhish11 5098 1.16 1.54 1.08 129 RELAYCOUNTRY_GB 5073 1.60 4.18 1.07 130 TR_XM_RelayPhish 4987 1.17 1.75 1.05 131 BAYES_95 4846 1.23 2.22 1.02 132 XM_UB50 4837 2.31 8.63 1.02 133 TooManyTo_004 4738 0.98 0.86 1.00 134 SpammyFromTLD_01 4401 1.12 2.07 0.93 135 T_FILL_THIS_FORM_SHORT 4352 1.15 2.25 0.92 136 XMBrknScrpt_02 4330 0.98 1.27 0.91 137 TM2_M_A_HREF_HREF 4315 0.92 0.96 0.91 138 NML_ADSP_CUSTOM_MED 4154 1.27 3.18 0.88 139 T_XMDrugObfuBody_00 4141 1.01 1.70 0.87 140 XMSexyCombo_01 4098 1.26 3.17 0.87 141 TooManyTo_005 4056 0.84 0.75 0.86 142 SpammyFromTLD_02 3887 3.32 15.53 0.82 143 XMBody_17 3709 1.04 2.28 0.78 144 RCVD_IN_BL_SPAMCOP_NET 3593 2.03 8.24 0.76 145 XM_ProductURIs 3567 0.76 0.80 0.75 146 DKIM_ADSP_NXDOMAIN 3287 0.95 2.20 0.69 147 XM_B_REG_HTML 3215 0.64 0.43 0.68 148 FILL_THIS_FORM 3171 0.70 0.86 0.67 149 T_Symld_Words_02 3153 1.04 2.88 0.67 150 XMSubMetaSxObfu_03 3118 0.75 1.20 0.66 151 SUBJ_DOLLARS 3057 0.72 1.09 0.65 152 T_OBFU_PDF_ATTACH 3051 0.57 0.22 0.64 153 XMHTMLBadTable_001 2843 0.62 0.74 0.60 154 XMPhish30 2833 0.68 1.06 0.60 155 HTML_FONT_FACE_BAD 2810 0.66 0.97 0.59 156 XM_B_COPY_HTML 2808 0.58 0.52 0.59 157 FILL_THIS_FORM_LONG 2795 0.62 0.75 0.59 158 T_TooManySym_03 2766 0.51 0.17 0.58 159 TR_XM_PHPDW 2743 0.87 2.28 0.58 160 TR_XM_PHPForged 2699 0.86 2.26 0.57 161 TR_XM_FormFill2 2676 0.85 2.25 0.57 162 XM_H_PHPOS 2659 0.85 2.25 0.56 163 XMNoVowels 2647 0.56 0.57 0.56 164 XMBody_78 2605 0.66 1.19 0.55 165 FROM_GOV_SPOOF 2569 0.54 0.51 0.54 166 RELAYCOUNTRY_AU 2565 0.56 0.67 0.54 167 RELAYCOUNTRY_FR 2562 1.06 3.60 0.54 168 HTTPS_HTTP_MISMATCH 2547 0.57 0.74 0.54 169 FILL_THIS_FORM_LOAN 2537 0.53 0.52 0.54 170 HTML_TAG_BALANCE_BODY 2499 0.53 0.56 0.53 171 LOW_PRICE 2474 0.50 0.42 0.52 172 RELAYCOUNTRY_DE 2474 0.68 1.47 0.52 173 XM_ShortIntro_01 2440 0.51 0.46 0.52 174 XMBody_95 2413 0.45 0.17 0.51 175 URI_NOVOWEL 2383 0.47 0.33 0.50 176 USER_IN_WHITELIST 2356 0.41 0.00 0.50 177 T_MANY_PILL_PRICE 2287 0.40 0.00 0.48 178 REMOVE_BEFORE_LINK 2283 0.48 0.48 0.48 179 PLING_QUERY 2273 0.88 2.85 0.48 180 XM_RXBody 2207 0.43 0.25 0.47 181 XM_D_tchamptons_WL 2177 0.38 0.00 0.46 182 XMPhish14 2139 0.56 1.10 0.45 183 XM_H_PHPMailer 2137 0.60 1.33 0.45 184 FORGED_GMAIL_RCVD 2117 0.91 3.18 0.45 185 T_MONEY_PERCENT 2113 0.87 2.95 0.45 186 TR_LOTS_OF_MONEY2 2113 0.87 2.95 0.45 187 TM2_M_BODY_EMPTY 2106 0.39 0.12 0.44 188 RDNS_DYNAMIC 2040 0.54 1.08 0.43 189 XMLngstWrd_00 2037 0.47 0.67 0.43 190 XM_URI_RBL 2006 1.07 4.25 0.42 191 XMHTML_After_End 1991 0.48 0.75 0.42 192 XMMoneyMeta_00 1971 0.87 3.06 0.42 193 SHORT_HELO_AND_INLINE_IMAGE 1936 0.34 0.03 0.41 194 MISSING_HEADERS 1935 0.52 1.09 0.41 195 XMSubMetaSxObfu_02 1929 0.40 0.35 0.41 196 HTML_IMAGE_ONLY_28 1929 0.45 0.67 0.41 197 XM_Body_Obfu01 1887 0.41 0.47 0.40 198 XMLngstWrd_01 1882 0.42 0.54 0.40 199 DIET_1 1859 0.56 1.39 0.39 200 RCVD_IN_SORBS_DUL 1853 0.94 3.63 0.39 ----------------------------------------------------------------------